CVE-2026-67224
published 2026-09-23CVE-2026-67224: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as…
PriorityP431medium4.9CVSS 3.1
AVNACLPRHUINSUCNIHAN
EPSS
0.36%
28.0th percentile
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ ".log") where Name comes from PUT /api/traces/:vhost/:name. No safe_relative_path / traversal check is applied on the write side, while the read side (rabbit_tracing_files.erl) does call rabbit_misc:safe_relative_path/1 , proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator. A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory. Preconditions include rabbitmq_tracing plugin enabled administrator tag Target path writable by rabbitmq OS user. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 3.13.0 < 3.13.15 | 3.13.15 |
| broadcom | rabbitmq_server | >= 4.0.0 < 4.0.20 | 4.0.20 |
| broadcom | rabbitmq_server | >= 4.1.0 < 4.1.11 | 4.1.11 |
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.6 | 4.2.6 |
| broadcom | rabbitmq_server | >= 4.3.0 < 4.3.1 | 4.3.1 |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
RabbitMQ up to 4.3.0 Tracing Plugin rabbit_tracing_files.erl Name path traversal
vuldb·2026-09-23·CVSS 2.1
CVE-2026-67224 [LOW] RabbitMQ up to 4.3.0 Tracing Plugin rabbit_tracing_files.erl Name path traversal
A vulnerability classified as problematic was found in RabbitMQ 3.13.14/4.0.19/4.1.10/4.2.5/4.3.0. This impacts an unknown function of the file rabbit_tracing_files.erl of the component Tracing Plugin. Such manipulation of the argument Name leads to path traversal.
This vulnerability is referenced as CVE-2026-67224. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
Red Hat
rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write
vendor_redhat·2026-09-23·CVSS 2.1
CVE-2026-67224 [LOW] CWE-22 rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write
rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write
A flaw was found in RabbitMQ, a messaging and streaming broker. A user with administrator privileges could exploit a path traversal vulnerability in the tracing plugin. By manipulating the name parameter, an attacker could write a .log-suffixed file to arbitrary filesystem paths writable by the rabbitmq user. This could lead to overwriting existing files or creating new files in sensitive directories, potentially allowing for further system compromise.
Package: rabbitmq-server4.2 (Red Hat Hardened Images) - Will not fix
Package: rabbitmq-server4.3 (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
2026-09-23
Published